linux-kernel - Re: [ANNOUNCE] UidBind LSM 0.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 24 Apr 2007 18:11:26 -0400 (EDT)
From:	Gerhard Mack <gmack@...erfire.net>
To:	Casey Schaufler <casey@...aufler-ca.com>
cc:	Roberto De Ioris <roberto@...it.it>,
	linux-security-module@...r.kernel.org,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [ANNOUNCE] UidBind LSM 0.2

On Tue, 24 Apr 2007, Casey Schaufler wrote:

> --- Gerhard Mack <gmack@...erfire.net> wrote:
> 
> > On Tue, 24 Apr 2007, Roberto De Ioris wrote:
> > 
> > > Hi all,
> > > 
> > > this is the second release for UidBind LSM:
> > > 
> > > http://projects.unbit.it/uidbind/
> > > 
> > > UidBind allows call to bind() function only to the uid defined in a
> > > configfs tree.
> > > 
> > > It is now possible to specify different uid (for the same port) on
> > > different ipv4 addresses:
> > > 
> > > mkdir uidbind/8081
> > > mkdir uidbind/8081/192.168.1.17
> > > mkdir uidbind/8081/192.168.1.26
> > > echo 1017 > uidbind/8081/192.168.1.17/uid
> > > echo 1026 > uidbind/8081/192.168.1.26/uid
> > > 
> > > This version even fix some leek in version 0.1
> > > 
> > > Patch attached is still for vanilla 2.6.20.7
> > 
> > Is it possible to specify ranges as allowing everyone?  Is it possible to 
> > allow multiple users acess to the same port?  Can ports be allowed by 
> > group?
> 
> If you're going to go beyond the simple owner access model it
> probably makes sense to go all out, swipe the file system ACL
> code and provide the whole nine yards of users, groups, and modes.
> The only system that I know of that had socket ACLs was the 4.X
> version of Trusted Irix, and socket ACLs were dropped in 5.0 because
> they were unpopular.
> 
> If you're daring you could propose that low number ports be treated
> the same way as other ports, with the default ownership being root and
> the default ACL allowing only root.

ACL may be more complicated than needed when a simple GID addition would 
make this right about perfect.

> > I really like the idea of this patch.  It has the potential to solve a lot 
> > of my current administrative headachs.
> 
> Putting access control on ports rather than sockets is a novel
> approach. It is a lot simpler underneath and more consistant with
> the way other object name spaces are treated.

Indeed I'm fond of it's rather simple and very scriptable interface.

	Gerhard

--
Gerhard Mack

gmack@...erfire.net

<>< As a computer I find your faith in technology amusing.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/